Then, in the training phase, the benign attack \(\emph {IP}(\cdot )\)  is evenly and iteratively switched within the range of the above attacks.
Empirically, we find that robustness against video codec simulation is much more important than robustness against the rest of the attacks. Therefore, we further propose two strategies in our adversarial training mechanism. First, we observe that the blurring results produced by median filtering and Gaussian blurring are close. We again use the ensembling strategy to linearly combine \(\emph {Gauss}(\mathbf {V}_\emph {tmp})\)  with \(\emph {Med}(\mathbf {V}_\emph {tmp})\)  as the mixed filtering operation. The benefit is that we moderately lower the importance of robustness against blurring, and further introduce randomness within the model.
Second, in some cases, we directly let \(\hat{\mathbf {V}}_\emph {ATK}^{codec}=\mathbf {V}_\emph {ATK}^{codec}\) , and address the non-differentiable problem by using the noise-addition strategy proposed by Zhang et al. [1]}. That is, the residual \(e=\mathbf {V}_\emph {ATK}^{codec}-\mathbf {V}_\emph {tmp}\)  is detached and directly added onto \(\mathbf {V}_\emph {tmp}\) . Therefore, \(\mathbf {V}_\emph {ATK}\)  in different training iteration \(\emph {iter}\)  is as follows.
\(\mathbf {V}_\emph {ATK}={\left\lbrace \begin{array}{ll}\emph {Resize}(\mathbf {V}_\emph {tmp}), & \emph {iter}\%4=0 \\\beta \cdot \emph {Med}(\mathbf {V}_\emph {tmp})+\gamma \cdot \emph {Gauss}(\mathbf {V}_\emph {tmp}), & \emph {iter}\%4=1 \\\hat{\mathbf {V}}_\emph {ATK}^{\emph {codec}}, & \emph {iter}\%4=2 \\\emph {stop\_grad}(e)+\mathbf {V}_\emph {tmp}, & \emph {iter}\%4=3 \\\end{array}\right.},\) 
